Synced vs Device-Bound Passkeys: A Practical Guide

TL;DR

Both are phishing-resistant. The real difference is where the private key lives.
Synced passkeys live in the user's passkey provider (iCloud Keychain, Google Password Manager, 1Password, Bitwarden) and follow them to new devices.
Device-bound passkeys never leave one device (FIDO2 security key, Microsoft Authenticator, Windows Hello).
Use synced for most users and device-bound for admins and other high-risk roles. That's also Microsoft's recommendation.
In Microsoft Entra ID you control all of this with passkey profiles.

A passkey is a key pair. Entra ID keeps the public key. The private key stays with the user and is unlocked with face, fingerprint or PIN. The passkey only works on the site it was created for, so a phishing page gets nothing.

Device-bound: the private key is created on one piece of hardware and never leaves it. Lose the device, lose the passkey.
Synced: the private key is encrypted and backed up to the user's passkey provider, then shows up on every device signed in to that account. Lose the phone, sign in on the new one, and the passkey is back.

Microsoft's own numbers from consumer accounts: 99% of users successfully register a synced passkey, and signing in takes about 3 seconds compared to 69 seconds for password plus MFA.

Side by side

	Device-bound	Synced
Phishing-resistant	Yes	Yes
Where the key lives	One device: security key, the phone's secure hardware, or Windows Hello on the PC	The user's passkey provider, synced to all their devices
Examples	FIDO2 security keys, Microsoft Authenticator, Microsoft Entra passkey on Windows	iCloud Keychain, Google Password Manager, 1Password, Bitwarden
New or lost device	Register again. Lost device means lost passkey	Already there. Restored from the provider
Attestation	Available for security keys and Authenticator	No
Main risk	Stolen device plus PIN	Takeover of the user's Apple, Google or password manager account
Cost	Hardware, logistics, helpdesk time	Close to zero

Attestation, briefly

Attestation is the authenticator proving what it is during registration, for example "genuine YubiKey 5" or "Microsoft Authenticator". In practice:

Enforce attestation = device-bound only. Synced passkeys can't provide attestation, so a profile with attestation enforced blocks them.
Without attestation, Entra ID can't guarantee anything about the passkey, not even whether it's synced or device-bound. AAGUID allow and block lists are then a guide, not a security control.
It's only checked at registration. Turning it on later doesn't remove passkeys that were registered without it. Clean those up yourself.

Who gets what

Users	Passkey types	Profile settings
Most employees	Synced and device-bound	Attestation off
Admins, executives, finance, anyone with access to sensitive systems	Device-bound only	Attestation on, optionally an AAGUID allow list for your approved authenticators
Personal Windows PCs (not joined or registered to Entra ID)	Microsoft Entra passkey on Windows	Device-bound, Windows Hello AAGUIDs allowed, attestation off

On shared PCs, give people a passkey they carry with them, such as a security key or a passkey on their phone. A passkey stored on a shared PC only works on that PC, and anyone who can unlock the Windows account it's stored in can use it.

If a regulation requires that the key never leaves the device (for example NIST AAL3), only device-bound passkeys qualify.

Day-to-day operations

Setting up passkey profiles

At the time of writing, you can have up to three passkey profiles, including the Default. Plan them before you start.
Profiles add up. A user in several profiles can register any passkey that satisfies just one of them. If your synced profile targets All users, your admins can register synced passkeys too. Target the synced profile at a group that excludes admins.
Excluding a group on the Passkey (FIDO2) policy blocks passkeys completely for that group. It's not a way to remove someone from a single profile.
Opting in to passkey profiles is one-way. You can't opt out.
Turning off synced passkeys in a profile also blocks sign-in with synced passkeys that are already registered. Warn users first.

Reviewing profile targeting

Profile targeting drifts. Groups change, and Microsoft can also change your authentication methods policy on your behalf, for example by moving users from SMS and voice into a profile that allows all passkey types.

Review which groups each profile targets on a regular schedule, and after any Microsoft-announced change to authentication methods.
The one thing to check every time: no admin should be in scope of a profile that allows synced passkeys.

Onboarding

Users must have completed MFA in the last five minutes to register a passkey. For new hires, issue a Temporary Access Pass (TAP) and have them register directly at Security info.
Use the registration campaign (Entra ID > Authentication methods > Registration campaign) to nudge existing users. It only nudges for passkeys that match the user's profile.
Encourage users to register at least two phishing-resistant credentials, so a lost or broken device doesn't lock them out. This matters most for device-bound users, for example two security keys, or a security key plus a passkey in Authenticator.

Lost or replaced device

Synced: usually nothing for IT to do. The user signs in to their passkey provider on the new device and the passkey is there.
Device-bound: delete the old passkey from the user's Authentication methods, issue a TAP and let them register a new one. If the user has no way in at all, Microsoft Entra ID Account Recovery can handle it without the helpdesk.
Authenticator on Android: changing the phone PIN, or switching between fingerprint and face, invalidates the passkey. The user signs in another way and creates a new one. Expect a few tickets after phone swaps and resets.

Offboarding and incidents

You can delete any passkey, synced or device-bound, from the user's Authentication methods in the admin center or through Microsoft Graph. After that it can't be used to sign in to Entra ID, no matter how many devices it synced to.
Passkeys don't expire. A passkey stays valid until someone deletes it, so remove the old one whenever a device is lost, replaced or handed over.

Enforcing it with Conditional Access

Use the built-in Phishing-resistant MFA authentication strength for the apps you want to protect. It accepts synced and device-bound passkeys alike.
Which type of passkey a user can sign in with is decided by their passkey profiles, not by Conditional Access. That's why keeping admins out of synced profiles matters.